Sri Lanka Institute of Information Technology

Enterprise Standards for Information Security
Year 3, Semester 2 – 2015
Assignment

IT13039264 – Fernando J.M.D
IT13104986 – Lakshan U.L.P.C

BUDGET

Before implementing ISO 27001, one needs to consider the costs and project length, which are further influenced by the detailed understanding of the implementation phases.

Implementation costs are driven by the perception of risk and how much risk an organization is prepared to accept. Four costs need to be considered when implementing this type of project:
Internal resources—The system covers a wide range of business functions including management, human resources (HR), IT, facilities and security. These resources will be required during the implementation of the ISMS.
External resources—Experienced consultants will save a huge amount of time and cost. They will also prove useful during internal audits and ensure a smooth transition toward certification. This will depend on the organization you choose to hire your consultants from.
Certification—Only a few approved certification agencies currently assess companies against ISO 27001, but fees are not much more than against other standards.
Implementation—These costs depend largely on the health of IT within the organization. If, as a result of a risk assessment or audit, a gap appears, then implementation costs are bound to go up based on the solution implemented.

Type of cost | Estimated Cost (USD) | Notes | Internal resources | 0 | Since the process will be a part of the duty of the employees, and the organization, there won’t be a considerable additional cost in using the internal resources. | External resources | 20,000 | Hiring external experts to launch the required audits and receive the consultation will cost this amount. | Certification | 10,000 | Having been consulted by the experts and after creating needed policies and launching them, a certificate will be the proof that the organization is following the standards. | Implementation | 18,000 | Depending on the gap between the existing standards and the ISO 27001 required standards this cost is estimated to cover up the gap. |

The implementing cost is quiet high since the currently followed procedures are not quiet standardized ones at the organization.